Executive Summary
AI security agents are moving from advice to action. They can investigate systems, test hypotheses, validate vulnerabilities, and propose fixes across red, blue, and green security work. But the model cannot do this alone. In this article, we unpack the harnesses that give AI security agents memory, tools, system access, and guardrails, turning model reasoning into sustained, governed action. We also explore an agentic security workflow and show what organizations need to deploy AI security agents safely, integrate them into existing operations, and move from periodic assessments towards continuous defense.
A wake-up call for AI security
In July, an internal OpenAI security evaluation took an unexpected turn. In an official statement, Hugging Face revealed that an intrusion into part of their production infrastructure had been detected - “supposedly executed by an AI agent system”. Shortly after, OpenAI confirmed the security incident, stating that an AI agent escaped its sandbox, reached the public internet, and accessed parts of Hugging Face’s production environment. The goal was not to attack Hugging Face. The agent was trying to complete a security benchmark. Instead of solving the challenge as intended, it found another route to the answer. That is what made the incident so striking. This was not a traditional penetration test guided step by step by a human. The agent explored, adapted, and acted across thousands of steps with limited human direction. It combined reasoning with tools, memory, and access to real systems. For us, the lesson goes beyond one incident. We are entering a phase where AI is no longer only supporting security professionals. It is starting to perform complex security work on its own. That changes both what security teams can achieve and how these systems need to be governed.
Why cybersecurity is entering a new era
The Hugging Face incident did not happen in isolation. When we look at the systems organizations need to protect today, the wider challenge becomes clear. Applications depend on cloud services, APIs, open source libraries, and AI components. Each connection creates another possible entry point. At the same time, security teams are under pressure. In ISC2’s 2025 workforce study, 88% of respondents said that cybersecurity skills shortages had already caused at least one significant consequence for their organization. Increasingly, the problem is not only the number of available professionals, but access to the specialized skills needed to address more complex threats. Manual penetration tests take time. Traditional scanners can find known patterns, but they often struggle when a vulnerability requires context, experimentation, or several connected steps. Attackers do not face the same constraints. They are already using automation and AI to move faster, adapt their tactics, and operate at greater scale. Security tooling must evolve as well.
Traditional scanning remains essential, but it is not enough for weaknesses that require context, experimentation, or several connected steps. This is where AI security agents add a new capability: they can form hypotheses, investigate them, and adapt their approach based on what they discover.
From security analysts to security agents
But what does that look like in practice? We can start with a structure many security teams already know: red, blue, and green teams.
Red teams think like attackers. They search for weaknesses and test whether those weaknesses can lead to a real compromise. Through AI penetration testing, agents can support this work through automated reconnaissance, exploit chaining, and privilege escalation.
Blue teams defend the organization. They investigate incidents, hunt for threats, and analyze large volumes of logs. Agents can connect signals, form hypotheses, and help analysts focus on the risks that matter most.
Green teams help organizations build secure products by default: standardized SDLC (software development lifecycle) redesign, AI coding policies, secure boilerplates, CI/CD security checks, and more. The goal is to prevent the next vulnerable system from shipping.
Big enterprises such as Microsoft are transforming this division into the era of agentic cybersecurity, as seen in Project Perception. Its red, blue, and green agents work together to discover risks, assess their importance, and improve protections as one continuous process. This is where the opportunity lies. The same autonomy that made the Hugging Face incident a wake-up call can also support defenders. Used within the right boundaries, AI agents can augment every stage of the cybersecurity lifecycle.
What makes an AI security agent’s harness different?
AI agents can support red, blue, and green teams. But to understand where those capabilities come from, we need to look beyond the model.
When people talk about generative AI, the large language model (LLM) usually receives most of the attention. It can analyze information, generate text, and reason about possible next steps. Here is where AI agents take off. An AI agent can pursue a goal, make decisions, use tools, and act within an environment. The harness coordinates the model, memory, tools, permissions, and execution environment that make this possible. Where a task benefits from specialization, the harness can also coordinate several agents working towards the same objective. This orchestration unlocks groundbreaking capabilities, moving AI from a passive assistant that answers questions to an autonomous workforce capable of solving complex, end-to-end cybersecurity challenges.
The harness is the layer that makes this possible.
It connects the agents to the systems around it. It manages planning, stores relevant memory, and determines tool access. Additionally, it controls deployment and governs how agents interact with source code, browsers, terminals, logs, or live applications. This distinction is critical: an LLM might suggest how to investigate a vulnerability, whereas an agent can directly interact with the source code by reading it, executing it, and identifying security flaws. The harness gives agents the execution layer needed to conduct the investigation, observe outputs, and iteratively adapt their approach.
What a harness controls
The harness also defines the limits of that autonomy. It can set budgets, restrict access, enforce safety boundaries, and require human approval for sensitive actions. More advanced harnesses can coordinate several agents in parallel, each working on a different part of the same objective. The Hugging Face incident showed why this orchestration layer deserves attention. The model provided the reasoning, but the surrounding system gave it memory, tools, access, and the ability to act across thousands of steps. The real innovation, then, is not only the model's intelligence. It is the harness that turns that intelligence into sustained action.
Inside an agentic AI security workflow
To make this concrete, we can follow an agentic security agent workflow step. OpenAI’s Codex Security illustrates how this functions in practice. While not the only agentic security tool available, it clearly demonstrates the shift from static scanning to active reasoning.
OpenAI describes Codex Security as a workflow that builds system context, validates potential vulnerabilities, and proposes context-aware fixes. To understand what this means in practice, we can break that adaptive loop into eight phases.
“Start with the system, not the vulnerability”
1. Understand the repository: Get the lay of the land
A traditional scanner starts with a static list of known vulnerability patterns. An agentic workflow begins by building deep system context. The agent analyzes source files, dependency structures, and commit histories to understand how the application functions as a whole.
2. Build a threat model: What are we protecting?
Using its structural understanding, the agent maps sensitive assets, data stores, and authorization controls to build an initial threat model. Security teams can and should refine this model with context the repository cannot reveal, such as deployment constraints, external controls, and relevant threat actors. This helps distinguish theoretical weaknesses from risks that actually matter in the application’s operating environment.
“Follow hypotheses, not signatures”
3. Find attack surfaces: Where could an attacker enter?
With the threat model in place, the agent identifies entry points where external inputs cross trust boundaries. A public API endpoint is not automatically a vulnerability, but it becomes an attack surface when it accepts untrusted input and connects to sensitive database operations.
4. Generate hypotheses: What could go wrong?
Instead of searching for simple signature matches, the agent forms targeted security hypotheses. For example, it might hypothesize that user input reaching a specific endpoint passes into a database query without sufficient sanitization.
5. Explore code & context: Follow the clues, read, trace, analyze
The agent evaluates its hypotheses by actively inspecting source code, tracing function calls across files, and analyzing surrounding security controls. If it discovers sanitization logic elsewhere in the execution path, it abandons the hypothesis and pivots to more promising leads.
“Prove what matters”
6. Run security checks: Test ideas, look for proof
When a hypothesis holds weight, the agent moves from passive analysis to active testing. It runs security commands, inspects configuration settings, and executes test scripts within an isolated sandbox environment to gather concrete evidence.
7. Validate findings: Can we prove it? What is the impact?
Identifying suspicious code is not enough. The agent must verify whether the weakness can be exploited in practice. It reproduces the behavior, measures the realistic business impact, and confirms whether the issue poses a genuine risk, eliminating false positives before raising an alert.
“Close the loop”
8. Report & suggest fixes: Clear findings, better security
Once validated, the workflow generates a structured report containing execution logs, affected components, and trace context. A dedicated fixing workflow then drafts a code patch, adds regression test cases, and submits the fix for human review before deployment.
When we step back, the difference becomes clear. This is not a straight line from code to alert. It is a loop:
Observe the system. Reason about a possible weakness. Act to investigate it. Verify the result. Then repeat.
That same ability to adapt made the Hugging Face incident a wake-up call. Within a controlled security workflow, it also makes an agent fundamentally different from a traditional vulnerability scanner.
Why this matters for organizations
Frontier models embedded into powerful harnesses are changing the economics of cybersecurity. Capabilities that once required scarce expert talent, such as analyzing large codebases, chaining exploits, and discovering zero-day vulnerabilities, can now be applied at much greater scale.
Organizations are therefore treating AI security as a strategic priority rather than an experiment. In the World Economic Forum’s Global Cybersecurity Outlook 2026, 94% of respondents expected AI to be the most significant driver of cybersecurity change in the year ahead.
Initiatives such as Anthropic’s Project Glasswing and OpenAI’s Daybreak show how this shift is taking shape. They move security beyond static AI suggestions towards active investigation, validation, and remediation under controlled access and human oversight.
But these capabilities are becoming available to attackers as well as defenders. As the barrier to advanced cyber operations falls, organizations can't rely solely on periodic assessments and reactive processes. They need security practices that operate continuously and adapt as quickly as the threats they face.
Agentic security changes how organizations manage risk across three major fronts:
- Moving from periodic audits to continuous defense. Annual penetration tests leave wide windows of exposure. Agentic workflows continuously stress test complex software applications as codebases evolve.
- Reducing triage fatigue through evidence. As studies from Microsoft and CMU show, traditional static scanners produce high volumes of false positives. AI-powered vulnerability scanning validates exploitability in sandboxed environments before raising alerts, helping teams prioritize validated risks.
- Closing the gap between exposure and fix. Discovering a vulnerability is only half the battle. Security agents bridge the gap by proposing patches and regression tests for human review.
Conclusion
AI security agents are changing cybersecurity from periodic analysis into continuous investigation and action. They can support red, blue, and green teams by exploring attack paths, validating findings, and helping move vulnerabilities towards remediation.
But the model cannot do this alone. The harness provides the memory, tools, access, coordination, and safeguards that turn reasoning into governed action. For organizations, the opportunity is therefore not simply to adopt a more capable model. It is to design an agentic security system that fits their environment, strengthens existing operations, and keeps people in control where it matters most.
How ML6 helps
Turning agentic capabilities into reliable security operations requires more than choosing the right model. It starts with understanding your systems, security processes, and risk boundaries. That is where we help.
At ML6, we combine expertise in frontier models, system orchestration, and enterprise governance. Our model-agnostic approach helps organizations translate autonomous AI capabilities into practical, controlled security workflows.
We help organizations strengthen their security posture across three practical motions:
- Red Team (Stress testing): AI-driven penetration testing across black box, grey box, and white box environments. This helps trace complex attack paths, test for prompt injection, and produce human-validated evidence.
- Blue Team (Live defense): Enabling your security operations center (SOC) with AI. This includes automated alert triage and threat intelligence enrichment. It also integrates response playbooks directly into your existing security information and event management (SIEM), endpoint detection and response (EDR), and cloud tooling.
- Green Team (Secure by default): Redesigning software development lifecycles with AI coding policies, secure boilerplates, automated CI/CD checks, and pre-production guardrails.
Ready to defend at the speed attackers are gaining? Explore our AI Cybersecurity offerings or contact our expert team to schedule a technical session.
What happens when harnesses go live?
Architecture diagrams are clean, but what happens when you turn an agentic harness loose on a live codebase?
In our next post, we’ll pit Codex Security head-to-head against another top agentic harness. We will look past the benchmark hype, trace real-time decisions, and reveal what actually happens when autonomous security agents take the wheel.
Follow ML6 on LinkedIn or visit our homepage so you do not miss the teardown.
